Who we are
Teslable is operated by Owlzworks (“we”). This policy explains what we collect when you use the Teslable app and website, why, and what you can do about it. It applies worldwide; the sections for the European Economic Area, California and Korea add the rights those laws give you.
What we collect
Only what a feature needs.
- Account: Teslable needs you to sign in, with a Google account or an Apple account. When you sign in we receive from that company your email address and its identifier for your account (a value that tells its users apart). If you sign in with Apple and choose “Hide My Email”, we receive a relay address made by Apple instead of your real one. We never receive a password. Besides that we keep your display name, language and unit preferences, the date you last used the account, your consents, and the sessions that keep you signed in (a hash of a random value, when it was made and when it was last used).
- Vehicle: VIN, model, software version. You can type the VIN or, if you prefer, sign in to your Tesla account to fetch it: we then ask Tesla once for the list of that account’s cars, read the VIN and keep nothing of the sign-in (for Sentry night-off, see below). We never see your Tesla password.
- Sentry night-off: to use it you sign in to your Tesla account and allow Teslable to send vehicle commands. We then keep the access and refresh tokens Tesla gives us, encrypted, on our servers. Every day at the time you chose we ask Tesla’s servers whether the car is awake and, if it is, send one command that turns Sentry Mode off. We also keep the chosen time, whether the feature is on, its readiness (whether Teslable’s key was added to the car) and each night’s result (turned off, already off, no answer and so on). We never see your Tesla password and never send a command that wakes the car.
- Vehicle data: position, speed, state of charge, charging state, tyre pressure, temperatures and odometer, read from the car by your phone over Bluetooth while the app is connected to it (including in the background). These readings, and the drive records, tyre records and parking spot made from them, are kept on your phone only and are not sent to our servers. While Drive Guide is on, the car’s position, speed and heading are passed to Kakao Mobility’s navigation SDK to get the enforcement cameras ahead (see “Who receives it” below). They are lost if you delete the app or change phones, and since we do not hold them we cannot restore them. One exception is an account for which we have switched on the diagnostic log to look into a problem (test accounts): there, positions and the times of prompts during Drive Guide are sent to our servers. The other is a device log you choose to send with feedback (it may contain vehicle and Bluetooth identifiers): that log is sent to our servers. We do not receive vehicle data from Tesla’s servers.
- Things you add: parking spot notes and pillar photos. They are kept on your phone only.
- Screen Link: the car screens you paired (name, when paired, when last seen), the public IP address a car screen last checked in from, and the signals your phone and the car screen exchange to connect. The IP address is used only to tell whether the car joined your phone’s hotspot and is never shown in the app; the signals are deleted after about 10 minutes.
- Ads: the app shows ads through Google AdMob. AdMob may collect an advertising ID and related data to serve and measure ads. Vehicle information (VIN, car position, drive records) is never given to advertisers.
- Ad reward check: to confirm that an ad was watched to the end, the app puts a one-time ticket it got from our server into the ad, and Google sends it back to us. The ticket is a random value; nothing that identifies you, your phone or your car is sent to Google. When the app asks for a ticket, it sends our server a random number made for that app install (install ID). On iPhone this number is kept in the device Keychain, so it may stay the same after you delete and reinstall the app.
- Ad log: when you tap to watch an ad, when a reward is confirmed, when no ad could be had (why, and whether your time was topped up because there was none) and when an ad was closed before its end are kept on our server, to answer questions and find abuse. Only the last 30 days are kept.
- Drive Guide usage limit: how many times Drive Guide called Kakao Mobility’s navigation SDK (the safety driving mode starting, a route to a destination found) is sent to our server per account and day. With it go the identifier the phone’s OS gives this app (Android ANDROID_ID, iPhone identifierForVendor) and the VIN of the car driven, which our server keeps only as keyed hashes that cannot be turned back into them. They are used to restrict an account over the daily limit, or used on the same phone as a restricted one (for this the app also sends them when it opens and before Drive Guide starts); an account used in the same car as a restricted one may be restricted after an administrator has looked at it. The advertising ID is not used. Appeals from a restricted account (the email for our reply and the message) are kept too.
- Feedback: the category you pick and the message you send, our replies to it, device information (app version and build, platform, OS version, phone model; no vehicle information) and the install ID. We keep it to answer you, and show the replies in the app under Settings → Feedback. The phone’s recent device log (the app log of the last 24 hours, and on Android the system log of the last 6 hours), which may contain vehicle and Bluetooth identifiers, is sent only if you turn on “Also send the device log”; otherwise it never leaves your phone.
- Website: no advertising cookies (this applies to the website only; for ads in the app see “Ads” above and “Who receives it” below). We keep a language preference in your browser.
Why we use it
To sign you in and keep your account, to run the features you turned on (including sending Sentry night-off’s command), to check your day pass and show ads, to confirm ad rewards and prevent abuse, to answer your feedback and tell you in the app that we replied, to keep the service secure, and to comply with law.
Who receives it
Processors that run parts of the service under contract:
- Tesla (account sign-in and Fleet API) — if you fetch the VIN by signing in: one request for the list of your cars, to read the VIN; the sign-in is not kept. If you turn on Sentry night-off: with the tokens we keep, at the time you chose, we ask whether the car is awake and send the command that turns Sentry Mode off (the car’s VIN goes with it). No other vehicle data is requested. United States.
- Kakao Mobility (navigation SDK) — the car’s position, speed and heading while Drive Guide is on, to get the enforcement cameras and limits ahead. Nothing that identifies your account or car is sent; installs are told apart by a random value made on the phone. We do not store what Kakao Mobility returns. Republic of Korea.
- Google (Android’s built-in address lookup) — the car’s position each time it has moved 300 m or more while Drive Guide is on, to show the name of the neighbourhood on the drive screen. Nothing that identifies your account or car is sent, and we do not keep the name. United States and other countries.
- Cloudflare, Inc. — API server (Workers), database (D1), Screen Link signalling (Durable Objects), website and domain. A US company; the database is kept in data centres in the Asia-Pacific region (Cloudflare chooses the country, and it cannot be pinned to Korea). See “Transfers abroad” below.
- Google AdMob — the app shows ads through Google AdMob. AdMob may collect an advertising ID and related data to serve and measure ads. Vehicle information (VIN, car position, drive records) is never given to advertisers. Ad rewards are confirmed with a one-time ticket only. United States and other countries.
Transfers abroad
To provide the service and store its data, we transfer personal information abroad as set out below. It is processing and storage on our behalf that is needed to perform our contract with you, so it is disclosed in this policy under Article 28-8(1)(iii) of Korea’s Personal Information Protection Act.
- Recipient: Cloudflare, Inc. (privacy contact privacy@cloudflare.com).
- Country: the United States (Cloudflare, Inc. is a US company). The database is kept in data centres in the Asia-Pacific region. Which country within the region is chosen by Cloudflare and not published, and it cannot be pinned to Korea. On the way, data may pass through Cloudflare’s network in other countries.
- What: account information (email address, Google or Apple account identifier, display name, language and unit preferences, the date last used, consents, sign-in sessions), the vehicle information you register (VIN, model, year and the like), Sentry night-off information (encrypted Tesla tokens, the chosen time and settings, each night’s result), Screen Link information (paired car screens, the car screen’s public IP address, connection signals), day pass and ad reward records (install ID, the hash of the ticket, when a pass was granted and when it ends), complimentary access records (when granted and when it ends), feedback and its replies (with its device information), device logs you chose to send, in-app notices, records of administrator actions, and connection information such as the IP address sent when you use the service.
- When and how: whenever you use the service, over encrypted network connections.
- Why: to provide the service (running the API server, connecting Screen Link) and to store its data.
- How long: until you leave (delete your account), or sooner where “How long we keep it” below sets a shorter time for an item (sign-in sessions 180 days after last use, reports and feedback 30 days, ad tickets a day after they expire, Screen Link signals about 10 minutes, the ad log 30 days). The records that stay, without your identity, after the account is deleted (records of administrator actions) are under “How long we keep it”.
- Saying no: if you do not want this transfer, do not use the service, or delete your account (in the app under Settings → Privacy & data → Delete account, or by writing to contact@owlz.works). Teslable’s servers and database all run on Cloudflare, so without this transfer the service cannot be used.
- What goes to Tesla (United States), Google AdMob and Google’s address lookup (United States and other countries) also leaves Korea; what is sent, why, and the country are under “Who receives it” above.
Ads and personalised ads
Vehicle information (VIN, car position, drive records) is never given to advertisers. Advertisers may collect device information such as an advertising ID.
- Android: turn personalised ads off under Settings → Google → Ads → Delete advertising ID.
- iPhone: the app asks whether to allow tracking. If you decline, the ads you see are not personalised. You can change it any time under Settings → Teslable.
How long we keep it
Vehicle signals and drive, tyre and parking records are not kept on our servers. They exist on your phone only, where the app removes drive records after 2 years, drive paths after 6 months and tyre records after 90 days. Parking notes and pillar photos: on the phone until you delete them. Account records: while your account exists. Sign-in sessions: they expire, and are deleted, 180 days after they were last used. Ad tickets: deleted a day after they expire. Feedback (message, category, device information and, if you chose to send it, the device log) and its replies: deleted 30 days after it was sent. Other device logs you sent (reports): deleted 30 days after they were sent. Screen Link signals: deleted after about 10 minutes. Ad log: the last 30 days only, and an account’s is deleted after 30 days with none. Sentry night-off’s Tesla tokens and settings: deleted with the car or the account; each night’s result: after 400 days (so the monthly record goes back over a year). Drive Guide usage counts: the last 30 days only; appeals from a restricted account: deleted with the account. The phone and car hashes of a restricted account: kept until the restriction is lifted, also after the account is deleted (so the same phone or car cannot simply be used again under another email).
When you delete your account, its data on our servers (sign-in sessions and identities, cars, Screen Link, day passes, complimentary access, reports, feedback, consents, in-app notices and the rest) is deleted at once. It stays in the database’s point-in-time recovery history (Cloudflare D1 Time Travel) for up to 7 days and then is gone. One thing remains after you delete your account, with no email or other identity, under the deleted account’s random number only: the record of actions an administrator took on the account (what, when and the values changed, kept for security and operations). Drive, tyre and parking records are on your phone only from the start; deleting the account in the app erases them on that phone too. If the account is deleted outside the app (by an email request), they stay on the phone until you delete the app or its data.
Your choices
You can change consents, export your data, and delete your account from Settings in the app, or by writing to contact@owlz.works. Vehicle data collection stops whenever you unlink the car or revoke Bluetooth or location permission; the app then works with what does not need the car.
Security
Traffic is encrypted in transit. Access is logged. No system is perfect; if a breach affects you we will tell you and the relevant authority without undue delay.
European Economic Area and United Kingdom
Legal bases: contract (running the service), legitimate interest (security, product improvement), consent (marketing emails, personalised ads). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority. Data is transferred to the United States under standard contractual clauses.
California
We do not sell personal information, and vehicle information is never given to advertisers. Ads in the app are shown by Google AdMob, which may collect an advertising ID and related data. You can turn personalised ads off as described under “Ads and personalised ads” above. You may request to know, delete or correct your information and will not be discriminated against for doing so. Requests: contact@owlz.works.
Korea (대한민국)
This section is the 개인정보처리방침 required by the Personal Information Protection Act and applies to users in Korea together with the rest of this policy.
- 수집 항목과 목적: 위 “What we collect” 및 “Why we use it” 항목과 같습니다. 필수 항목은 로그인에 쓰는 Google·Apple 계정의 이메일 주소와 계정 식별자, 그리고 차량 식별 정보입니다. 위치정보는 폰이 블루투스로 차와 연결된 동안 위치가 필요한 기능(주행 안내, 주행 기록, 주차 위치 기억 등)을 위해 쓰며 회사 서버로 보내지 않습니다. 주행 안내 중에는 단속 카메라 정보를 받기 위해 카카오모빌리티로 전달됩니다.
- 보유 기간: 차량 신호와 주행·타이어·주차 기록은 회사 서버에 보관하지 않음(폰에만 저장). 계정 정보는 회원 탈퇴(계정 삭제) 시 바로 파기(데이터베이스 복구용 시점 기록에는 최대 7일 남음). 관리자 조치 기록은 이메일 등 신원 정보 없이, 삭제된 계정의 임의 번호로만 보관.
- 제3자 제공 및 처리위탁: 위 “Who receives it” 항목과 같으며 국외 이전(미국 등: Cloudflare, Tesla, Google AdMob 등)이 포함됩니다. 이전받는 자, 국가, 항목, 시기와 방법, 목적, 보유 기간, 거부 방법은 위 “Transfers abroad” 항목에 있습니다. 카카오모빌리티로의 위치 전달은 국내에서 이루어집니다.
- 위치정보: 차량 위치의 수집·이용·제공은 별도의 위치정보 이용약관에 따르며, 이용자는 언제든지 수집 동의를 철회할 수 있습니다.
- 이용자 권리: 열람·정정·삭제·처리정지 요구는 앱 설정 또는 contact@owlz.works 로 하실 수 있습니다. 만 14세 미만은 가입할 수 없습니다.
- 개인정보 보호책임자: Owlzworks 개인정보 보호책임자, contact@owlz.works.
Children
Teslable is for adults who own or drive a car. We do not knowingly collect data from anyone under 16 (under 14 in Korea).
Changes
We will post changes here and, for material changes, tell you in the app before they take effect.
28 October 2026: Sentry night-off’s result for each night is kept 400 days instead of 30, and the weekdays it runs are kept with its settings.
26 October 2026: Sentry night-off was added. When you use it we keep your Tesla tokens, encrypted, and at the time you chose send the command that turns Sentry Mode off through Tesla’s Fleet API.
22 October 2026: the servers and database moved from Supabase and Google Cloud (Seoul) to Cloudflare (a US company, Asia-Pacific data centres), and the “Transfers abroad” section was added. Sign-in is now with a Google or Apple account; starting without an email and email sign-in are gone. Deleting your account deletes its server data at once.